HIPAA Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Effective date: August 18, 2026 | Last updated: August 18, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. Green Light SSA LLC is required by law to maintain the privacy of protected health information (PHI), to provide you with notice of our legal duties and privacy practices with respect to PHI, and to notify you following a breach of unsecured PHI.

1. Who We Are

Green Light SSA LLC ("Green Light") is a document preparation and professional matching service that handles Protected Health Information (PHI) in connection with preparing Social Security disability applications. As a business that handles PHI on behalf of individuals, we are subject to the Health Insurance Portability and Accountability Act (HIPAA) and its implementing regulations.

2. What Is Protected Health Information (PHI)?

PHI is any information we hold about you that relates to your past, present, or future physical or mental health condition, the provision of health care to you, or payment for health care — and that could identify you. This includes medical records, physician letters, RFC assessments, denial letters referencing your medical condition, and information you provide in your intake form about your diagnoses, treatments, and functional limitations.

3. How We Use and Disclose Your PHI

For case preparation (Treatment purposes)

We use your PHI to generate pre-filled SSA forms, conduct AI-powered document review, and create a case summary for professional matching. This is the primary purpose for which we collect your information.

For professional matching

We share your case file, including PHI, with the paralegal or attorney matched to your case. These professionals receive access to your full case package through a secure, token-gated link — your PHI is never transmitted directly in email bodies. Professionals in our network are bound by written agreements that restrict use of your PHI to your case.

As required by law

We may disclose PHI when required by federal or state law, court order, subpoena, or to report to government agencies as required by law.

We will NOT use or disclose your PHI for:

Marketing or advertising purposes
Sale to third parties
Any purpose not described in this Notice without your written authorization

4. How We Protect Your PHI

All PHI is transmitted over HTTPS using 256-bit encryption
Documents and case files are stored in Amazon Web Services (AWS S3) with AES-256 server-side encryption at rest
Access to case packages is restricted to token-gated, time-limited links
We maintain an audit log of all professional access to case files
We conduct regular security reviews of our technical infrastructure
Employees and contractors with access to PHI are trained in HIPAA requirements

Your Rights Under HIPAA

You have the following rights regarding PHI we maintain about you. To exercise any of these rights, contact us at support@greenlightssa.com.

Right to Access: You have the right to inspect and receive a copy of PHI we maintain about you. We will provide access within 30 days of your request.
Right to Amend: You have the right to request that we correct or update PHI you believe is inaccurate or incomplete.
Right to an Accounting of Disclosures: You have the right to request a list of certain disclosures we have made of your PHI.
Right to Restrict: You have the right to request restrictions on how we use or disclose your PHI, though we are not always required to agree to your request.
Right to Confidential Communications: You have the right to request that we communicate with you in a specific way or at a specific location.
Right to a Paper Copy of This Notice: You have the right to a paper copy of this Notice. Contact us at the address below to request one.

5. Breach Notification

In the event of a breach of unsecured PHI, we will notify you as required by HIPAA's Breach Notification Rule — within 60 days of discovery of the breach, or sooner when possible. Notification will include: a description of what happened, what types of PHI were involved, steps you should take to protect yourself, what we are doing to investigate and mitigate the breach, and contact information for questions.

6. Our HIPAA Compliance Program

Green Light maintains a written HIPAA compliance program that includes a risk assessment, policies and procedures covering the Privacy Rule and Security Rule, a Business Associate Agreement with Amazon Web Services (our infrastructure provider), and ongoing staff training. Our HIPAA compliance program is administered through Medcurity.

7. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you for filing a complaint.

To file a complaint with Green Light: support@greenlightssa.com

To file a complaint with HHS OCR: www.hhs.gov/ocr/privacy/hipaa/complaints

8. Changes to This Notice

We reserve the right to change the terms of this Notice at any time. Changes will apply to PHI we already hold as well as PHI we receive in the future. We will post the updated Notice on our website and will make the new Notice available upon request.

9. Contact

Privacy Officer: Green Light SSA LLC
Email: support@greenlightssa.com
Amarillo, Texas